https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:36:05 +0000 https://vulnerability.circl.lu/vuln/cve-2023-47627 <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.</p> <p><strong>Affected:</strong> aio-libs aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.</p> https://vulnerability.circl.lu/vuln/cve-2023-47627 https://vulnerability.circl.lu/vuln/ghsa-gfw2-4jvh-wgfg <p><strong>Affected:</strong> PyPI: aiohttp</p> <p># Summary The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel). # Details</p> <p>## Bug 1: Bad parsing of `Content-Length` values</p> <p>### Description RFC 9110 says this: &gt; `Content-Length = 1*DIGIT`</p> <p>AIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.</p> <p>### Examples ``` GET / HTTP/1.1\r\n Content-Length: -0\r\n \r\n X ``` ``` GET / HTTP/1.1\r\n Content-Length: +0_1\r\n \r\n X ```</p> <p>### Suggested action Verify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.</p> <p>## Bug 2: Improper handling of NUL, CR, and LF in header values</p> <p>### Description RFC 9110 says this: &gt; Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.</p> <p>AIOHTTP&#39;s HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing the…</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p># Summary The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when `AIOHTTP_NO_EXTENSIONS` is enabled (or not using a prebuilt wheel). # Details</p> <p>## Bug 1: Bad parsing of `Content-Length` values</p> <p>### Description RFC 9110 says this: &gt; `Content-Length = 1*DIGIT`</p> <p>AIOHTTP does not enforce this rule, presumably because of an incorrect usage of the builtin `int` constructor. Because the `int` constructor accepts `+` and `-` prefixes, and digit-separating underscores, using `int` to parse CL values leads AIOHTTP to significant misinterpretation.</p> <p>### Examples ``` GET / HTTP/1.1\r\n Content-Length: -0\r\n \r\n X ``` ``` GET / HTTP/1.1\r\n Content-Length: +0_1\r\n \r\n X ```</p> <p>### Suggested action Verify that a `Content-Length` value consists only of ASCII digits before parsing, as the standard requires.</p> <p>## Bug 2: Improper handling of NUL, CR, and LF in header values</p> <p>### Description RFC 9110 says this: &gt; Field values containing CR, LF, or NUL characters are invalid and dangerous, due to the varying ways that implementations might parse and interpret those characters; a recipient of CR, LF, or NUL within a field value MUST either reject the message or replace each of those characters with SP before further processing or forwarding of that message.</p> <p>AIOHTTP&#39;s HTTP parser does not enforce this rule, and will happily process header values containing these three forbidden characters without replacing the…</p> https://vulnerability.circl.lu/vuln/ghsa-gfw2-4jvh-wgfg https://vulnerability.circl.lu/vuln/pysec-2023-246 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There are no known workarounds for these issues.</p> https://vulnerability.circl.lu/vuln/pysec-2023-246